review: fix review findings (correctness, hardening, doc-accuracy)

First recursive code-review-harness pass over the authored SDK code (sim/,
config-lint, flowgen, drivers/{relays,freshness}, build/, ci.yml). Four parallel
dimension reviewers; all findings at every severity corrected per workspace rule.

Correctness / reliability:
- freshness.c min_budget_ms: use a `seen` flag, not `best==0`, as the empty
  sentinel — a zero-tolerance (max_stale_ms==0) binding was silently widened to a
  looser neighbour's budget. Regression test added; still 66/66 MC/DC.
- config-lint parse_reserved_ranges: match `reg` as a whole property token (ident
  boundary before, `=` after) so `reg-names` / a `region-*` label no longer
  mis-parses into a bogus reserved range.
- config-lint loader check: fail closed — flag any loader with a LOAD_ADDR that is
  not a known-safe boot component, instead of only known MCU names, so a future
  coprocessor ("Rtos"/"Bl32") can't slip past the 0x40000-brick gate.
- build-kernel.sh: sha256 verification is now mandatory (refuse to build if the pin
  is missing) and the mktemp scratch tree is removed on exit (trap), while a
  caller-provided WORK is left intact for CI artifact upload.

Test quality:
- freshness: added the age==max_stale boundary case and a clock-wraparound
  (now < last_ok) fail-safe-to-UNKNOWN test.
- relays: unsetenv(WARDEN_GPIO_ROOT) at main() so the NULL-env arm is hermetic.

Security / CI:
- ci.yml: top-level `permissions: contents: read` (badges overrides to write);
  pin taiki-e/install-action to commit SHA (v2.86.7).

Maintainability / docs:
- drivers/enforce-mcdc.sh: one shared, name-derived gate replaces the two
  copy-pasted per-driver scripts; Makefiles call ../../enforce-mcdc.sh.
- docs/architecture.md: §3/§4/§6/§7 rewritten to match reality — NPU/RGA models,
  config-lint, and the relays+freshness MC/DC harnesses are done; kernel §6 now
  reflects the 5.10->6.18.46 forward-port (ADR-0001), not the superseded plan44/6.6.
- README: status blurb + layout table corrected (kernel/, .github/; stale ci/ and
  patches/ descriptions fixed). hpmcu "8 tests" -> 7 in docs.
- freshness.{c,h}: ADR reference points at flare-edge ADR-0004 (warden-sdk's
  ADR-0004 is the CI runner — number collision).
- normalize rustfmt drift across sim/ + config-lint.

All green: sim 37 tests, config-lint 8 tests, both drivers 100% MC/DC (relays
40/40, freshness 66/66), clippy clean under -D warnings, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

sim/src/rga.rs

@@ -52,7 +52,10 @@ pub struct RgaSim {
 impl RgaSim {
     /// A working RGA whose `improcess` succeeds.
     pub fn new() -> Self {
-        Self { status: ImStatus::Success, blits: Vec::new() }
+        Self {
+            status: ImStatus::Success,
+            blits: Vec::new(),
+        }
     }
 
     /// Program the status `improcess` returns (set `Failed` to drive the driver's
@@ -63,7 +66,12 @@ impl RgaSim {
 
     /// Model one `improcess()` call: record it and return the programmed status.
     pub fn improcess(&mut self, src: Surface, dst: Surface, srect: Rect, drect: Rect) -> ImStatus {
-        self.blits.push(Blit { src, dst, srect, drect });
+        self.blits.push(Blit {
+            src,
+            dst,
+            srect,
+            drect,
+        });
         self.status
     }
 
@@ -99,7 +107,11 @@ mod tests {
     use super::*;
 
     fn surf(w: i32, h: i32) -> Surface {
-        Surface { width: w, height: h, format: 0 }
+        Surface {
+            width: w,
+            height: h,
+            format: 0,
+        }
     }
     fn rect(w: i32, h: i32) -> Rect {
         Rect { x: 0, y: 0, w, h }
@@ -108,7 +120,12 @@ mod tests {
     #[test]
     fn records_a_successful_blit() {
         let mut r = RgaSim::new();
-        let st = r.improcess(surf(720, 720), surf(360, 360), rect(720, 720), rect(360, 360));
+        let st = r.improcess(
+            surf(720, 720),
+            surf(360, 360),
+            rect(720, 720),
+            rect(360, 360),
+        );
         assert_eq!(st, ImStatus::Success);
         assert_eq!(r.count(), 1);
         let b = r.last().unwrap();
@@ -120,8 +137,10 @@ mod tests {
     fn failed_status_drives_fallback() {
         let mut r = RgaSim::new();
         r.set_status(ImStatus::Failed);
-        assert_eq!(r.improcess(surf(10, 10), surf(10, 10), rect(10, 10), rect(10, 10)),
-                   ImStatus::Failed);
+        assert_eq!(
+            r.improcess(surf(10, 10), surf(10, 10), rect(10, 10), rect(10, 10)),
+            ImStatus::Failed
+        );
         // the op is still recorded — the driver dispatched it, then fell back.
         assert_eq!(r.count(), 1);
     }